Net::IDN::Punycode versions from 2.301 through 2.589 contain a heap use‑after‑free when decoding punycode labels that contain code points that trigger a buffer reallocation. The XS backend inserts each decoded code point into a scalar's string buffer; when the buffer grows, the insertion pointer is not updated, so the subsequent write writes into freed memory. This flaw manifests as a read and write of freed heap memory and is classified as CWE‑416.

Perl applications that use the Net::IDN::Punycode library, specifically versions 2.301 up to 2.589. The XS backend is the only affected implementation; the pure‑Perl backend is unaffected.

The flaw exposes a heap use‑after‑free that can be triggered by any entity able to supply a punycode label. A CVSS score of 8.4 indicates high severity, and an EPSS score of < 1% reflects a low probability of exploitation in the wild; the vulnerability is not listed in the CISA KEV catalog. Despite the modest exploitation probability, the capability for arbitrary memory read/write and potential code execution motivates a high risk assessment. Exploitation would likely involve sending a malicious punycode string to a service that decodes it without additional validation.